In btmaclprocessscacmplpkt of btmacl.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"81257196526678989726396645813638291950",
"71742954271496379196641737395202578278",
"274413850910844254790803102295370981272"
]
},
"id": "PUB-A-251427561-a1729a54",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b008a2ac04e6806717e4c8fb2330b3c4a3e847a",
"target": {
"file": "system/stack/acl/btm_acl.cc"
}
},
{
"digest": {
"length": 480.0,
"function_hash": "228729823883497116222531814507499603851"
},
"id": "PUB-A-251427561-b08f721f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b008a2ac04e6806717e4c8fb2330b3c4a3e847a",
"target": {
"function": "btm_acl_process_sca_cmpl_pkt",
"file": "system/stack/acl/btm_acl.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b008a2ac04e6806717e4c8fb2330b3c4a3e847a"
],
"types": [
"ID"
],
"spl": "2023-06-01",
"severity": "Moderate"
}
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"81257196526678989726396645813638291950",
"71742954271496379196641737395202578278",
"274413850910844254790803102295370981272"
]
},
"id": "PUB-A-251427561-421f7eac",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b008a2ac04e6806717e4c8fb2330b3c4a3e847a",
"target": {
"file": "system/stack/acl/btm_acl.cc"
}
},
{
"digest": {
"length": 480.0,
"function_hash": "228729823883497116222531814507499603851"
},
"id": "PUB-A-251427561-d2d2c85c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b008a2ac04e6806717e4c8fb2330b3c4a3e847a",
"target": {
"function": "btm_acl_process_sca_cmpl_pkt",
"file": "system/stack/acl/btm_acl.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b008a2ac04e6806717e4c8fb2330b3c4a3e847a"
],
"types": [
"ID"
],
"spl": "2023-06-01",
"severity": "Moderate"
}